CIA Part 1, Unit 1: Foundations of Internal Auditing
Free study notes for Section A: Foundations of Internal Auditing, which is 35% of the CIA Part 1 exam. Topics: Purpose of internal auditing, Mandate, Charter, Independence, Risk and the Three Lines Model.
Practice 116 free questionsOpen CIA Drill
Purpose of internal auditing
- Definition: An independent, objective assurance and advisory service that adds value and improves operations.
- Value: Independent, risk-based, objective assurance, advice, insight, and foresight for the board and management.
- Most effective when: Done by skilled professionals who follow the Standards, independent with direct accountability to the board, and unbiased.
- Evaluates: Governance, risk management, and control processes.
Mandate
- Who sets it: The board establishes, approves, and supports the mandate (Principle 6).
- What it is: Internal audit's authority, role, and responsibilities, documented in the charter.
- CAE's job: Give the board and senior management the information needed to set the mandate (Standard 6.1).
- Law prescribes it: Then the charter must include the legal requirements.
- Reassess: When the Standards, law, strategy, board, or structure change. Consider formally at least annually.
Charter
- Must specify: Purpose, adherence to the Standards, mandate (scope and services), and organizational position and reporting lines (Standard 6.2).
- Also covers: Administrative reporting, safeguards for independence, unrestricted access, communications, audit process, quality program, approvals.
- Approval: The CAE presents it at a board meeting and the board approves it.
Independence
- Definition: Freedom from conditions that impair the ability to act without bias.
- Needs: The CAE reports directly to the board, is qualified, and is positioned to work without interference.
- Confirm: The CAE confirms organizational independence to the board at least annually (Standard 7.1).
- Reporting: Functional to the board. Administrative usually to the CEO.
- Interference: Late information, restricted access, cut budget, pressure to change findings.
- Nonaudit roles: Disclose them and add safeguards. For temporary nonaudit work, an independent third party oversees for 12 months afterward.
Risk and the Three Lines Model
- Risk: The positive or negative effect of uncertainty on objectives.
- Risk management: Identify, assess, manage, and control events to give reasonable assurance on objectives.
- First line: Management and staff who run operations and own risk.
- Second line: Risk, compliance, and similar functions giving expertise, monitoring, and challenge.
- Third line: Internal audit gives independent assurance and advice.
- Six principles: Governance; governing body roles; first and second line roles; third line roles; third line independence; creating and protecting value.
Test yourself on this unit
Reading is only half of studying. CIA Drill has 116 free exam-style questions for this unit, each with an explanation, and spaced review that brings missed questions back. You can also take timed mock tests that follow the real exam weighting.